ARP moving in security run output

[mguebert]

I get these errors in my security run output, not every day but often enough that I am concerned about a possible problem. Is this anything to concern myself with. I am wondering if this is a response to me logging in remotely via my vpn?


NAS.local kernel log messages:
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0
> arp: 192.168.1.1 moved from 00:42:43:ae:00:bd to a0:04:60:1b:12:ee on em0
> arp: 192.168.1.1 moved from a0:04:60:1b:12:ee to 00:42:43:ae:00:bd on em0

 

[dlavigne]

https://forums.freenas.org/index.php?threads/kernel-log-arp-moved-from-to-on-igb0.43597/#post-287975.

 

[c32767a]

If his router is on 1.1, then that might not be normal behavior.

This is the kernel reporting it's learning 2 ethernet addresses for the same IP address. One MAC is a Netgear. The other isn't allocated, so could be anything.
If 192.168.1.1 is his router, this might be a problem, since this type of message usually means 2 devices are trying to use the same IP at the same time.

In either case, it's a networking problem, not a FreeNAS problem though.

 

[mguebert]

Thanks for the clarification, yes that is my router, 1.1 the netgear mac could be my AP however it shouldn't be anywhere near the .20 the FreeNAS box is on, those are static IP addresses.